diff --git a/debian/changelog b/debian/changelog index 96dbfbf8557fb66c52d7e56f8ea7a2cbd0cfa7fe..1c124fdb406029e5543b2c6e7b3b40f81389e4e8 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +pcre3 (2:8.39-ok3) yangtze; urgency=medium + + * damizhou CVE-2020-14155 安全更新:PCRE 输入验证错误漏洞. + + -- panchuanzhou Thu, 09 Mar 2023 14:52:57 +0800 + pcre3 (2:8.39-ok2) yangtze; urgency=medium * gjq0613 CVE-2019-20838 安全更新:Buffer error vulnerability diff --git a/pcre_compile.c b/pcre_compile.c index 7cd395012304e588a6ef3c7167e17111ba69829d..c7422271876305caa583774d1a534ac0ffe590cf 100644 --- a/pcre_compile.c +++ b/pcre_compile.c @@ -7086,17 +7086,19 @@ for (;; ptr++) int n = 0; ptr++; while(IS_DIGIT(*ptr)) + { n = n * 10 + *ptr++ - CHAR_0; + if (n > 255) + { + *errorcodeptr = ERR38; + goto FAILED; + } + } if (*ptr != CHAR_RIGHT_PARENTHESIS) { *errorcodeptr = ERR39; goto FAILED; } - if (n > 255) - { - *errorcodeptr = ERR38; - goto FAILED; - } *code++ = n; PUT(code, 0, (int)(ptr - cd->start_pattern + 1)); /* Pattern offset */ PUT(code, LINK_SIZE, 0); /* Default length */